pgadmin.org vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-86864 pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailinHigh 8.7 · Sep 17, 2026
• CVE-2026-86863 pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered throughCritical 9.3 · Sep 17, 2026
• CVE-2026-86862 pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql.High 7.1 · Sep 17, 2026
• CVE-2026-17566 pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendCritical 9.4 · Jul 31, 2026
• CVE-2026-17351 The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exacCritical 9.4 · Jul 31, 2026
• CVE-2026-17349 /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server vCritical 9.3 · Jul 31, 2026
• CVE-2026-17347 The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with High 7.7 · Jul 31, 2026
• CVE-2026-17346 The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several High 8.7 · Jul 31, 2026
• CVE-2026-12048 Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths.Critical 9.3 · Jun 18, 2026
• CVE-2026-12046 Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connectioCritical 9.5 · Jun 18, 2026
• CVE-2026-12045 Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SCritical 9.4 · Jun 18, 2026
• CVE-2026-12044 SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ...High 8.7 · Jun 18, 2026
• CVE-2026-7819 Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.High 7.2 · May 11, 2026
• CVE-2026-7818 Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.High 7.3 · May 11, 2026
• CVE-2026-7817 Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.High 7.1 · May 11, 2026
• CVE-2026-7816 OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.High 8.7 · May 11, 2026
• CVE-2026-7815 SQL injection vulnerability in pgAdmin 4 Maintenance Tool.High 8.7 · May 11, 2026
• CVE-2026-7813 Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.Critical 9.4 · May 11, 2026
• CVE-2026-1707 pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restoHigh 7.4 · Feb 5, 2026
• CVE-2025-13780 pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLACritical 9.1 · Dec 11, 2025
• CVE-2025-12765 pgAdmin <= 9.9  is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.High 7.5 · Nov 13, 2025
• CVE-2025-12764 pgAdmin <= 9.9  is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the High 7.5 · Nov 13, 2025
• CVE-2025-12762 pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAICritical 9.1 · Nov 13, 2025
• CVE-2025-9636 pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability.High 7.9 · Sep 4, 2025
• CVE-2025-2946 pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS).Critical 9.1 · Apr 3, 2025